CVE-2021-26594

8.8 highEPSS 1.2%

High (8.8) in rangerstudio directus. EPSS 1.2% chance of exploitation in the next 30 days.

In Directus 8.x through 8.8.1, an attacker can switch to the administrator role (via the PATCH method) without any control by the back end. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.2% chance of exploitation in the next 30 days; higher than 67% of CVEs (scores of 2026-10-31)
CWE: CWE-269
Published: 2021-02-23
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

rangerstudio:directus

References

https://github.com/sgranel/directusv8
https://github.com/sgranel/directusv8

Check your stack JSON